2-aiml-security-codebuild.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: AIML Multi-Account Security Assessment Solution

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: ReSCO Assessment Options
        Parameters:
          - MultiAccountScan
          - MultiAccountListOverride
          - EmailAddress
      - Label:
          default: Advanced Options
        Parameters:
          - ConcurrentAccountScans
          - CodeBuildTimeout
          - ReSCORole
          - GitHubRepoUrl
          - GitHubBranch

Parameters:
  GitHubRepoUrl:
    Type: String
    Description: GitHub repository URL
    Default: https://github.com/aws-samples/sample-resco-aiml-assessment.git
    AllowedPattern: ^https:\/\/github\.com\/[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(\.git)?$
    ConstraintDescription: Must be a valid GitHub repository URL (e.g., https://github.com/owner/repo or https://github.com/owner/repo.git)

  GitHubBranch:
    Type: String
    Description: GitHub branch to build from
    Default: main

  ReSCORole:
    Description: "The role that ReSCO should assume to perform the assessment."
    Type: String
    Default: ReSCOAIMLMemberRole

  MultiAccountScan:
    Description: "Set this to true if you want to scan all accounts in your organization."
    Type: String
    AllowedValues:
      - "true"
      - "false"
    Default: "false"

  MultiAccountListOverride:
    Description: "Specify a space delimited list of accounts to scan. Leaving this blank will scan all accounts in your organization."
    Type: String
    Default: ""

  EmailAddress:
    Description: "Specify an address if you want to receive an email when the assessment completes."
    Type: String
    Default: ""
    AllowedPattern: ^$|^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$
    ConstraintDescription: Must be a valid email address or leave empty

  ConcurrentAccountScans:
    Description: "For multi-account scans, specify the number of accounts to scan concurrently."
    Type: String
    AllowedValues:
      - "Three"
      - "Six"
      - "Twelve"
    Default: "Three"

  CodeBuildTimeout:
    Description: "Set the timeout for the CodeBuild job. The default is 300 minutes (5 hours)."
    Type: Number
    MinValue: 5
    MaxValue: 2160
    Default: 300

Conditions:
  CreateReSCORole: !Equals
    - !Ref MultiAccountScan
    - false

  CreateEmailNotification: !Not [!Equals [!Ref EmailAddress, ""]]

Mappings:
  CodeBuildPerformanceOptionMap:
    Three:
      ParallelAccounts: 3
      CodeBuildComputeType: BUILD_GENERAL1_SMALL
    Six:
      ParallelAccounts: 6
      CodeBuildComputeType: BUILD_GENERAL1_MEDIUM
    Twelve:
      ParallelAccounts: 12
      CodeBuildComputeType: BUILD_GENERAL1_LARGE

Resources:
  # Local ReSCO role for single account assessments
  ReSCOMemberRole:
    Condition: CreateReSCORole
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/service-role/"
      RoleName: ReSCOAIMLMemberRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:root"
            Action:
              - "sts:AssumeRole"
            Condition:
              ArnEquals:
                aws:PrincipalArn: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/ReSCOMultiAccountCodeBuildRole
      Policies:
        - PolicyName: ReSCOAIMLAssessmentPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - iam:ListRoles
                  - iam:ListUsers
                  - iam:ListAttachedRolePolicies
                  - iam:ListAttachedUserPolicies
                  - iam:ListRolePolicies
                  - iam:ListUserPolicies
                  - iam:GetRolePolicy
                  - iam:GetUserPolicy
                  - iam:GetPolicy
                  - iam:GetPolicyVersion
                  - iam:GenerateServiceLastAccessedDetails
                  - iam:GetServiceLastAccessedDetails
                  - sts:GetCallerIdentity
                  - bedrock:ListGuardrails
                  - bedrock:GetGuardrail
                  - bedrock:GetModelInvocationLoggingConfiguration
                  - bedrock:ListPrompts
                  - bedrock:GetPrompt
                  - bedrock:ListAgents
                  - bedrock:GetAgent
                  - sagemaker:ListNotebookInstances
                  - sagemaker:DescribeNotebookInstance
                  - sagemaker:ListDomains
                  - sagemaker:DescribeDomain
                  - sagemaker:ListTrainingJobs
                  - sagemaker:DescribeTrainingJob
                  - sagemaker:ListModelPackageGroups
                  - sagemaker:ListModelPackages
                  - sagemaker:ListFeatureGroups
                  - sagemaker:ListPipelines
                  - sagemaker:ListPipelineExecutions
                  - sagemaker:ListProcessingJobs
                  - sagemaker:DescribeProcessingJob
                  - sagemaker:ListMonitoringSchedules
                  - sagemaker:DescribeMonitoringSchedule
                  - cloudtrail:ListTrails
                  - cloudtrail:GetTrail
                  - cloudtrail:GetEventSelectors
                  - lambda:ListFunctions
                  - ecs:ListClusters
                  - ecs:ListTasks
                  - ecs:DescribeTasks
                  - ec2:DescribeVpcEndpoints
                  - ec2:DescribeVpcs
                  - kms:DescribeKey
                  - kms:ListAliases
                  - guardduty:GetFindings
                  - guardduty:ListFindings
                  - guardduty:ListDetectors
                  - guardduty:GetDetector
                  - guardduty:GetFindingsStatistics
                  - guardduty:ListPublishingDestinations
                  - guardduty:ListTagsForResource
                  - guardduty:GetMemberDetectors
                  - guardduty:DescribeMalwareScans
                  - guardduty:GetRemainingFreeTrialDays
                  - guardduty:GetUsageStatistics
                  # Bedrock AgentCore Permissions
                  - bedrock-agentcore:ListAgentRuntimes
                  - bedrock-agentcore:GetAgentRuntime
                  - bedrock-agentcore:ListMemories
                  - bedrock-agentcore:GetMemory
                  - bedrock-agentcore:ListGateways
                  # ECR Permissions for AgentCore encryption checks
                  - ecr:DescribeRepositories
                  - ecr:GetRepositoryPolicy
                  # CloudWatch Logs Permissions for AgentCore observability checks
                  - logs:DescribeLogGroups
                  - logs:DescribeLogStreams
                  # Additional EC2 Permissions for AgentCore VPC checks
                  - ec2:DescribeSubnets
                  - ec2:DescribeRouteTables
                  - ec2:DescribeNatGateways
                Resource: "*"

  # S3 bucket for assessment results
  ReSCOAssessmentBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  ReSCOAssessmentBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref ReSCOAssessmentBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowSSLRequestsOnly
            Principal: "*"
            Action: "s3:*"
            Effect: Deny
            Resource:
              - !Sub "${ReSCOAssessmentBucket.Arn}"
              - !Sub "${ReSCOAssessmentBucket.Arn}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  # CodeBuild role for running assessments
  ReSCOMultiAccountCodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      Path: "/service-role/"
      RoleName: ReSCOMultiAccountCodeBuildRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: "sts:AssumeRole"
            Effect: Allow
            Principal:
              Service:
                - codebuild.amazonaws.com
      Policies:
        - PolicyName: LogGroup
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*"
        - PolicyName: UploadtoS3
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - s3:PutObject
                  - s3:GetObject
                Effect: Allow
                Resource: !Sub "${ReSCOAssessmentBucket.Arn}/*"
              - Action:
                  - s3:GetObject
                  - s3:ListBucket
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:s3:::resco-aiml-security-*"
                  - !Sub "arn:${AWS::Partition}:s3:::resco-aiml-security-*/*"
        - PolicyName: AssumeRole
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - sts:AssumeRole
                Effect: Allow
                Resource: !Sub "arn:${AWS::Partition}:iam::*:role/service-role/ReSCOAIMLMemberRole"
        - PolicyName: ListOrganizationAccounts
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - organizations:ListAccounts
                  - organizations:DescribeAccount
                  - organizations:ListTagsForResource
                Effect: Allow
                Resource: "*"
        - PolicyName: CloudFormationPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - cloudformation:CreateStack
                  - cloudformation:UpdateStack
                  - cloudformation:DeleteStack
                  - cloudformation:DescribeStacks
                  - cloudformation:DescribeStackEvents
                  - cloudformation:DescribeStackResources
                  - cloudformation:GetTemplate
                  - cloudformation:GetTemplateSummary
                  - cloudformation:ListStackResources
                  - cloudformation:CreateChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:DeleteChangeSet
                  - cloudformation:ListStacks
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:stack/resco-aiml-*/*"
                  - !Sub "arn:${AWS::Partition}:cloudformation:*:${AWS::AccountId}:stack/aws-sam-cli-managed-default/*"
              - Action:
                  - cloudformation:GetTemplateSummary
                  - cloudformation:CreateChangeSet
                Effect: Allow
                Resource:
                  - !Sub "arn:${AWS::Partition}:cloudformation:*:aws:transform/Serverless-2016-10-31"
              - Action:
                  - cloudformation:GetTemplateSummary
                  - cloudformation:ListStacks
                Effect: Allow
                Resource: "*"
        - PolicyName: SAMPermissions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: LambdaPermissions
                Action:
                  - lambda:CreateFunction
                  - lambda:DeleteFunction
                  - lambda:GetFunction
                  - lambda:GetFunctionConfiguration
                  - lambda:UpdateFunctionCode
                  - lambda:UpdateFunctionConfiguration
                  - lambda:AddPermission
                  - lambda:RemovePermission
                  - lambda:TagResource
                  - lambda:UntagResource
                  - lambda:ListTags
                  - lambda:InvokeFunction
                  - lambda:PublishVersion
                  - lambda:GetPolicy
                Effect: Allow
                Resource: '*'
              - Sid: IAMPermissions
                Action:
                  - iam:CreateRole
                  - iam:DeleteRole
                  - iam:GetRole
                  - iam:AttachRolePolicy
                  - iam:DetachRolePolicy
                  - iam:PutRolePolicy
                  - iam:DeleteRolePolicy
                  - iam:GetRolePolicy
                  - iam:TagRole
                  - iam:UntagRole
                  - iam:ListRolePolicies
                  - iam:ListAttachedRolePolicies
                Effect: Allow
                Resource: '*'
              - Sid: IAMPassRole
                Action:
                  - iam:PassRole
                Effect: Allow
                Resource:
                  - !Sub 'arn:${AWS::Partition}:iam::*:role/resco-aiml-*'
              - Sid: StepFunctionsPermissions
                Action:
                  - states:CreateStateMachine
                  - states:DeleteStateMachine
                  - states:DescribeStateMachine
                  - states:UpdateStateMachine
                  - states:TagResource
                  - states:UntagResource
                  - states:ListStateMachines
                  - states:StartExecution
                  - states:DescribeExecution
                  - states:ListExecutions
                Effect: Allow
                Resource: '*'
              - Sid: S3Permissions
                Action:
                  - s3:CreateBucket
                  - s3:DeleteBucket
                  - s3:PutBucketPolicy
                  - s3:GetBucketPolicy
                  - s3:DeleteBucketPolicy
                  - s3:PutBucketVersioning
                  - s3:PutBucketPublicAccessBlock
                  - s3:GetBucketPublicAccessBlock
                  - s3:PutBucketAcl
                  - s3:GetBucketAcl
                  - s3:PutBucketTagging
                  - s3:GetBucketTagging
                  - s3:PutBucketNotification
                  - s3:GetBucketNotification
                  - s3:PutBucketLogging
                  - s3:GetBucketLogging
                  - s3:PutEncryptionConfiguration
                  - s3:GetEncryptionConfiguration
                  - s3:ListBucket
                  - s3:GetBucketLocation
                  - s3:GetBucketVersioning
                  - s3:PutObject
                  - s3:GetObject
                  - s3:DeleteObject
                  - s3:DeleteObjectVersion
                Effect: Allow
                Resource: "*"

  # CodeBuild project for running assessments
  ReSCOMultiAccountCodeBuild:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: ReSCOMultiAccountCodeBuild
      Environment:
        ComputeType:
          !FindInMap [
            CodeBuildPerformanceOptionMap,
            !Ref ConcurrentAccountScans,
            "CodeBuildComputeType",
          ]
        Image: "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
        Type: "LINUX_CONTAINER"
        EnvironmentVariables:
          - Name: BUCKET_REPORT
            Value: !Ref ReSCOAssessmentBucket
            Type: PLAINTEXT
          - Name: GITHUB_REPO_URL
            Value: !Ref GitHubRepoUrl
            Type: PLAINTEXT
          - Name: GITHUB_BRANCH
            Value: !Ref GitHubBranch
            Type: PLAINTEXT
          - Name: RESCO_ROLE
            Value: !Ref ReSCORole
            Type: PLAINTEXT
          - Name: MULTI_ACCOUNT_SCAN
            Value: !Ref MultiAccountScan
            Type: PLAINTEXT
          - Name: MULTI_ACCOUNT_LIST_OVERRIDE
            Value: !Ref MultiAccountListOverride
            Type: PLAINTEXT
          - Name: AWS_PARTITION
            Value: !Sub ${AWS::Partition}
            Type: PLAINTEXT
          - Name: AWS_ACCOUNT_ID
            Value: !Sub ${AWS::AccountId}
            Type: PLAINTEXT
          - Name: PARALLEL_ACCOUNTS
            Value:
              !FindInMap [
                CodeBuildPerformanceOptionMap,
                !Ref ConcurrentAccountScans,
                "ParallelAccounts",
              ]
            Type: PLAINTEXT
      Description: Run ReSCO AIML assessment
      ServiceRole: !GetAtt ReSCOMultiAccountCodeBuildRole.Arn
      TimeoutInMinutes: !Ref CodeBuildTimeout
      Artifacts:
        Type: NO_ARTIFACTS
      SourceVersion: !Ref GitHubBranch
      Source:
        Type: GITHUB
        Location: !Ref GitHubRepoUrl
        GitCloneDepth: 1

  # Lambda function to start CodeBuild
  CodeBuildStartBuildLambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: StartBuildInline
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - "codebuild:StartBuild"
                Resource: !GetAtt ReSCOMultiAccountCodeBuild.Arn

  CodeBuildStartBuildLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.lambda_handler
      Role: !GetAtt CodeBuildStartBuildLambdaRole.Arn
      Timeout: 120
      Runtime: python3.12
      Code:
        ZipFile: |
          import boto3
          import logging
          from botocore.exceptions import ClientError
          import cfnresponse

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          def startBuild(event, context):
            responseData = {}
            try:
              project_name = event.get('ResourceProperties', {}).get('ProjectName')
              if not project_name:
                raise ValueError("ProjectName is required")

              cb = boto3.client('codebuild')
              logger.info(f"Starting build for project: {project_name}")
              response = cb.start_build(projectName=project_name)
              responseData['buildID'] = response['build']['id']
              logger.info(f"Build started: {responseData['buildID']}")
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
            except ClientError as e:
              error_msg = e.response['Error']['Message']
              logger.error(f"AWS error: {error_msg}")
              cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': error_msg})
            except Exception as e:
              logger.error(f"Error: {str(e)}")
              cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)})

          def no_op(event, context):
            cfnresponse.send(event, context, cfnresponse.SUCCESS, {})

          def lambda_handler(event, context):
            logger.info(f"Request type: {event.get('RequestType')}")
            try:
              if event['RequestType'] == 'Create':
                startBuild(event, context)
              else:
                no_op(event, context)
            except Exception as e:
              logger.error(f"Unhandled error: {str(e)}")
              cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)})

  CodeBuildStartBuild:
    Type: Custom::CodeBuildStartBuild
    DependsOn: ReSCOAssessmentBucketPolicy
    Properties:
      ServiceToken: !GetAtt CodeBuildStartBuildLambda.Arn
      ProjectName: !Ref ReSCOMultiAccountCodeBuild

  # SNS topic for notifications (optional)
  ReSCONotificationTopic:
    Condition: CreateEmailNotification
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: !Ref EmailAddress
          Protocol: email

  ReSCOSnsNotificationsPolicy:
    Condition: CreateEmailNotification
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: snsNotificationsPolicy
        Version: "2012-10-17"
        Statement:
          - Sid: Allow events
            Effect: Allow
            Principal:
              Service: "events.amazonaws.com"
            Action:
              - sns:Publish
            Resource: !Ref ReSCONotificationTopic
      Topics:
        - !Ref ReSCONotificationTopic

  CodeBuildStateChangeRule:
    Condition: CreateEmailNotification
    Type: AWS::Events::Rule
    Properties:
      EventBusName: default
      EventPattern:
        source:
          - aws.codebuild
        detail-type:
          - CodeBuild Build State Change
        detail:
          build-status:
            - SUCCEEDED
            - FAILED
            - STOPPED
          project-name:
            - !Ref ReSCOMultiAccountCodeBuild
      State: ENABLED
      Targets:
        - Id: toSNS
          Arn: !Ref ReSCONotificationTopic
          InputTransformer:
            InputPathsMap:
              build-status: $.detail.build-status
              bucket: $.detail.additional-information.environment.environment-variables[0].value
            InputTemplate: >-
              "The ReSCO AIML assessment has <build-status>."

              "You can view your results in the <bucket> bucket."

Outputs:
  AccountID:
    Description: AWS Account ID where the AI-ML Security Assessment is executed from
    Value: !Ref AWS::AccountId

  AssessmentBucket:
    Description: S3 bucket containing assessment results (HTML reports and CSV data)
    Value: !Ref ReSCOAssessmentBucket

  CodeBuildProjectName:
    Description: CodeBuild project name for running assessments
    Value: !Ref ReSCOMultiAccountCodeBuild